CVE-2026-46072: ntfs3: add buffer boundary checks to run_unpack()
In the Linux kernel, the following vulnerability has been resolved:
ntfs3: add buffer boundary checks to rununpack()
rununpack() checks runbuf < runlast at the top of the while loop but then reads sizesize and offsetsize bytes via rununpacks64() without verifying they fit within the remaining buffer. A crafted NTFS image with truncated run data in an MFT attribute triggers an OOB heap read of up to 15 bytes when the filesystem is mounted.
Add boundary checks before each rununpacks64() call to ensure the declared field size does not exceed the remaining buffer.
Found by fuzzing with a source-patched harness (LibAFL + QEMU).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1 - Configuration
Upgrade/patch the Linux kernel to a version that includes the resolution for ntfs3: add buffer boundary checks to run_unpack() so that size_size/offset_size bytes read via run_unpack_s64() do not exceed the remaining buffer (beyond the existing run_buf < run_last check).
Linux kernel (ntfs3 filesystem driver) Enable updated kernel with ntfs3 buffer boundary checks = Apply the resolved fix so run_unpack() verifies run_unpack_s64() reads stay within the remaining buffer
Event History
Frequently Asked Questions
Which systems are realistically exposed?
Systems that mount NTFS filesystems using the Linux kernel ntfs3 driver are exposed when they process an NTFS image containing truncated run data in an MFT attribute. The issue can be triggered during filesystem mount.
What does an attacker need to exploit this issue?
An attacker needs the ability to provide or cause a system to mount a crafted NTFS image. The attack is local according to the supplied vector and does not require user interaction.
What is the expected impact of successful exploitation?
The vulnerable parsing can cause an out-of-bounds heap read of up to 15 bytes. The supplied impact metrics indicate high confidentiality impact and high availability impact, with no integrity impact.
What can be done while a patched kernel is not available?
Update to a Linux kernel release that includes the referenced stable fixes. If updating is not immediately possible, avoid mounting untrusted NTFS images with the ntfs3 driver.